Summary
Due to a missing authentication check, the WAGO Solution Builder and the WAGO Device Sphere are vulnerable to a potential information exposure.
Impact
Exposing database credentials gives attackers direct database access, leading to data loss, theft or manipulation. Exposing user accounts and roles facilitates targeted attacks like brute-force or social engineering, increasing the risk of compromising privileged accounts.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| WAGO Software Device Sphere <1.1.0 | WAGO Software Device Sphere <1.1.0 | |
| WAGO Software Solution Builder <2.3.3 | WAGO Software Solution Builder <2.3.3 |
Vulnerabilities
Expand / Collapse allThe database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
Remediation
Please upgrade to the specified version or a later one of the WAGO Device Sphere or the WAGO Solution Builder.
| Affected Product | Fixed Version |
|---|---|
| WAGO Software Device Sphere | 1.1.0 |
| WAGO Software Solution Builder | 2.3.3 |
Acknowledgments
WAGO GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 09/24/2025 11:00 | Initial Release. |